9 ms·
A lot of us InfoSec folks consider this very good practice to be 100% open about how security technologies are deployed. Ever heard about security by obscurity?
by mrb 5y ago
A lot of us InfoSec folks consider this very good practice to be 100% open about how security technologies are deployed. Ever heard about security by obscurity? It confers a false (dangerous!) sense of security, and prevents your security stack from being audited/reviewed even by casual comments, like it's literally happening right now on HN.
- 123pie123 5y agoare you saying that it's best for companies to openly publish all their (network) security?
- ziddoap 5y agoPublish procedures? Yes. Generally speaking, an open and auditable system is more robust and secure than a closed and non-auditable system. There are obviously limits (e.g. publishing what specific VLAN numbering scheme you use is obviously not helpful to anyone and just provides information that wasn't known). But yes, it is best practice to publish and accept feedback on generalized procedures. You should sign up for the MDSP dev-security-policy mailing list and see how the (open) conversations have continued to improve security for all.
- 123pie123 5y agofully audited absolutely yes, feedback come internally with many (100's) of technical/ network architects poking and proding I fail to see any positives in openly publishing anything, unless you provide an extememly very detailed view - I see only negatives